ib[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ib.exe
Size 3.4MB
Sample261107-p189mads9p
SHA256 a54646f38152d426089d5ea3b346782a0843abcbc6d9245ddd7708ffffc92d6b
MD5 c6b04301f21145595cdc60c185833335
SHA1 f3f4d5325fd97084bdda5ae4a166e384b8299f5c
SHA512 5b7807dfdf2e3c68d7c264830d97bb0794c23ba58dc56e9d8e88431876ae28635b4ee94bfc1c273313938e2ea13fccc84cf907bf0ac9a81f2a9d10f74ad16540
SSDEEP 49152:o6LKY0VvYKDtreEwS+Igtgj6di0cYhk7KGZITMsQKNZo4:ZiV1D+Ltgj6di4UKGuN
TLSH
T1A1F5BF01F6E69673D1B312B005BAF731873DBB1087338A5B2294D65E2CA13D19B7B366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ib.exe

File Explorer

ib.exe

.exe 3.4MB

ib.exe

IMPHASH 3abf94ee3ba841134edae6684ecb2bf2
SHA256 a54646f38152d426089d5ea3b346782a0843abcbc6d9245ddd7708ffffc92d6b
MD5 c6b04301f21145595cdc60c185833335
SHA1 f3f4d5325fd97084bdda5ae4a166e384b8299f5c
SHA512 5b7807dfdf2e3c68d7c264830d97bb0794c23ba58dc56e9d8e88431876ae28635b4ee94bfc1c273313938e2ea13fccc84cf907bf0ac9a81f2a9d10f74ad16540
SSDEEP 49152:o6LKY0VvYKDtreEwS+Igtgj6di0cYhk7KGZITMsQKNZo4:ZiV1D+Ltgj6di4UKGuN
TLSH
T1A1F5BF01F6E69673D1B312B005BAF731873DBB1087338A5B2294D65E2CA13D19B7B366
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1723216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\İBLİK\Desktop\vs 2022\ib\bin\Release\net10.0\win-x86\native\ib.pdb

advapi32

AdjustTokenPrivileges DeregisterEventSource GetTokenInformation ImpersonateLoggedOnUser LookupPrivilegeValueW OpenProcessToken OpenThreadToken RegCloseKey RegEnumKeyExW RegNotifyChangeKeyValue RegOpenKeyExW RegQueryValueExW RegisterEventSourceW ReportEventW RevertToSelf

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptExportKey BCryptImportKeyPair BCryptHashData BCryptGetProperty BCryptCloseAlgorithmProvider BCryptCreateHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDestroyKey

crypt32

CertNameToStrW CertGetNameStringW CertGetCertificateContextProperty CertGetCertificateChain CertFreeCertificateContext CertOpenStore CryptImportPublicKeyInfoEx2 CryptFormatObject CryptFindOIDInfo CryptDecodeObject CertVerifyCertificateChainPolicy CertFreeCertificateChainEngine CertAddCertificateContextToStore CertAddCertificateLinkToStore CertCloseStore CertControlStore CertCreateCertificateChainEngine CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateChain

iphlpapi

ConvertInterfaceNameToLuidW GetAdaptersAddresses GetNetworkParams GetPerAdapterInfo ConvertInterfaceLuidToIndex

kernel32

IsDebuggerPresent IsProcessorFeaturePresent InitializeSListHead SetUnhandledExceptionFilter RtlUnwind FlsFree EncodePointer InitializeCriticalSectionEx K32GetProcessMemoryInfo CancelIoEx CancelSynchronousIo CancelThreadpoolIo CloseHandle CloseThreadpoolIo CloseThreadpoolWait CloseThreadpoolWork CreateEventExW CreateFileW CreatePipe CreateProcessW CreateThread CreateThreadpoolIo CreateThreadpoolTimer CreateThreadpoolWait CreateThreadpoolWork DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FlushFileBuffers FormatMessageW FreeLibrary GetCPInfo GetCPInfoExW GetConsoleCP GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetCurrentThreadId GetDynamicTimeZoneInformation GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLogicalDrives GetLongPathNameW GetModuleFileNameW GetOverlappedResult GetProcAddress GetProcessId GetStdHandle GetSystemDirectoryW GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation InitializeConditionVariable InitializeCriticalSection K32EnumProcesses LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree MultiByteToWideChar OpenProcess OpenThread QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException ReadFile ResetEvent ResumeThread SetEvent SetFileInformationByHandle SetFilePointerEx SetLastError SetThreadErrorMode SetThreadPriority SetThreadpoolTimer SetThreadpoolWait Sleep SleepConditionVariableCS StartThreadpoolIo SubmitThreadpoolWork SystemTimeToFileTime TzSpecificLocalTimeToSystemTime VirtualAlloc VirtualFree WaitForMultipleObjectsEx WaitForSingleObject WaitForThreadpoolWaitCallbacks WakeConditionVariable WideCharToMultiByte WriteFile AddVectoredExceptionHandler GetModuleHandleW RtlCaptureContext RaiseException FlsAlloc FlsGetValue FlsSetValue WaitForSingleObjectEx CreateEventW GetCurrentProcessId SwitchToThread SuspendThread FlushProcessWriteBuffers GetThreadContext SetThreadContext GetSystemTimeAsFileTime CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask CopyContext InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLargePageMinimum VirtualUnlock GetWriteWatch ResetWriteWatch VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber

ncrypt

NCryptFreeObject NCryptGetProperty NCryptImportKey NCryptOpenKey NCryptOpenStorageProvider NCryptSetProperty NCryptDeleteKey

ole32

CoCreateGuid CoGetApartmentType CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize CoWaitForMultipleHandles

ws2_32

getpeername WSACleanup closesocket bind accept WSAStartup WSASocketW WSASend shutdown WSARecv WSAIoctl setsockopt send select recv listen ioctlsocket getsockopt FreeAddrInfoExW FreeAddrInfoW GetAddrInfoExW GetAddrInfoW GetNameInfoW WSAGetOverlappedResult WSAConnect getsockname

api-ms-win-crt-heap-l1-1-0

free _callnewh calloc _set_new_mode malloc

api-ms-win-crt-math-l1-1-0

floor __setusermatherr ceil _libm_sse2_log_precise log2 modf

api-ms-win-crt-string-l1-1-0

_stricmp strcpy_s

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s _set_fmode __p__commode

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _register_thread_local_exe_atexit_callback abort _c_exit terminate _cexit _controlfp_s __p___wargv exit _initialize_wide_environment __p___argc _crt_atexit _exit _initterm_e _initterm _get_initial_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe

api-ms-win-crt-locale-l1-1-0

_configthreadlocale